This vulnerability affects Oracle HRMS (Republic of Korea) versions 12.2.3 through 12.2.15 and allows an unauthenticated remote attacker to compromise the system via HTTP. Successful exploitation requires human interaction from a third party. The attacker can gain unauthorized read access to some data and unauthorized update, insert, or delete access to some accessible data within Oracle HRMS. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and low confidentiality and integrity impacts with no availability impact. Oracle has published a Critical Patch Update advisory in July 2026 but does not explicitly confirm a patch for this specific vulnerability yet. Customers are advised to stay current with patches and monitor Oracle's official security alerts.

An unauthenticated attacker with network access via HTTP can exploit this vulnerability to gain unauthorized read access and unauthorized update, insert, or delete access to some data in Oracle HRMS (Republic of Korea). The impact affects confidentiality and integrity but does not affect availability. Exploitation requires user interaction from a person other than the attacker, which limits the ease of exploitation.

Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying security patches promptly when available and remaining on actively supported versions. Until a patch is released, consider limiting network access to Oracle HRMS and educating users to avoid interacting with untrusted content that could trigger exploitation.